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Coinhive crypto-jacking increasingly 
pops up in top 3 million websites 

Not even ordering pizza is safe from the browser 
crypto-mining scourge 


By John Leyden 9 Nov 2017 at 12:33 23 Q SHARE ▼ 



A total of 2,531 of the top 3 million websites (1 in 1,000) are running the 
Coin Hive miner, according to new stats from analytics firm Red Volcano. 


BitTorrent sites and the like were the main offenders but the batch also 
included the Ecuadorian Papa John's Pizza website [see source code]. 

JavaScript-based Coin Hive crypto-mining software on websites is bad 
news for surfers because the technology can suck up power and 
resources without user consent. 
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Coin Hive launched a service this year that allowed mining of a digital 
currency called Monero directly within a web browser. The simplicity of 
the Coin Hive integration made the approach successful but partly due to 
several initial oversights - most notably through a failure to enforce an 
opt-in process to establish user consent - the technology has been 
widely abused. 


Drive-by download 



Drive-by mining 


Website 



Coinhive API Cryptomining 



Drive-by mining is the new drive-by downloading [source: Malwarebytes white 

paper] 


Some less than salubrious web portals started to run the Coin Hive 
JavaScript in non-throttled mode, tying up visitors' machines in the 
process. In other cases hackers planted code crypto-mining software on 
third-party websites, a practice known as either crypto-jacking or drive-by 
mining, as security biz Malwarebytes put it. 
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US and Spain top the list of countries most impacted by drive-by mining 
[source: Malwarebytes] 

Instances of crypto-mining code on webpages or buried within rogue 
smartphone apps keep rolling in. 

Security vendor Ixia warns two games on the Google Play store, Puzzle 
and Reward Digger, by AK Games are actively mining cryptocurrency 
from thousands of infected Android mobile phones. 


Android cryptocurrency mining malware can be quite lucrative for 
cybercriminals. For instance, total profits earned on one specific 
Magicoin wallet are equal to $1,150 at current exchange rates, according 
to Ixia's report. This makes cryptominers the next generation of adware 
software, Ixia concluded. 


Elsewhere Netskope discovered a Coin Hive miner installed as a plugin 
on a tutorial webpage for Microsoft Office 365 OneDrive for Business. 
The offending website - https://www.sky-futuref.3net - removed the Coin 
Hive plugin after it was notified about the issue. "The tutorial webpage 
hosted on the website was saved to the cloud and then shared within an 
organisation," according to Netskope. 

Microsoft told El Reg that its "security software detects and blocks this 
application." Ad blockers and antivirus programs have also added 
features that block browser mining but few security watchers think this 
alone will bring the issue to heel. The opportunity to coin in 
cryptocurrency by enslaving the machines of others is just too tempting 
for unscrupulous websites and black hats. ® 
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Sponsored: Minds Mastering Machines - Call for papers now open 

Tips and corrections 

|>x3 Sign up to our Newsletter - Get IT in your inbox daily 
MORE Cryptocurrency Coinhive Crypto Miner 




. MB 

v Dorado 

Dorado Token Sale is live 
and selling out quickly! 

- GETYOUR - 

30% BON US 

Buy tokens 

get 30% bonus 


More from The Register 



China bans cryptocurrency fundraising 
schemes 

Bitcoin, Ethereum values dip after 'Initial Coin 
Offerings' ruled dangerously disruptive 



Judge bins sueball lobbed at 
Malwarebytes by rival antivirus maker 
for torpedoing its tool 

Litigious security biz upset at blanket PC ban 



Paris Hilton inflates cryptocurrency 
bubble some more, backs Initial Coin 
Offering 

Meanwhile, China says of ICOs: That's hot, we 
mean, er, banned 
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Argy-bargy Argies barge into 
Starbucks Wi-Fi with alt-coin 
discharges 

Venti vanilla skinny latte with sprinkles of 
JavaScript and a side of Monero mining, 
please 



Another banking trojan is trying to loot 
your cryptocurrency wallets 

Trickbot variant adds Coinbase exchange to 
monitored sites 



And Oracle E-biz suite makes 3: 
Package also vulnerable to exploit 
used by cryptocurrency miner 

Hat trick! 


Whitepapers 



Why IT Struggles with Digital Transformation 

Massive backlogs, legacy debt, and scarce resources can 
hinder digital transformation efforts. So, how you can overcome 
these challenges? 



5 Benefits of Disaster Recovery in the Cloud 

Organisations are counting on the cloud to make sure they 
retain access to their critical corporate data. 



Move your SAP applications to Oracle Cloud 
Infrastructure 

The key to successful cloud migration lies in testing and 
evaluating the solutions. 



Leaders in advanced IT analytics 

Moogsoft has been selected as a leader in advanced IT 
analytics (AIA). 


Sponsored links 

Get The Register's Headlines in your inbox daily - quick signup! 
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